Skip to content

Commit fd1a95d

Browse files
committed
Bluetooth: bnep: fix wild-memory-access in proto_unregister
jira LE-2177 cve CVE-2024-50148 Rebuild_History Non-Buildable kernel-5.14.0-503.19.1.el9_5 commit-author Ye Bin <[email protected]> commit 64a9099 There's issue as follows: KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f] CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G W RIP: 0010:proto_unregister+0xee/0x400 Call Trace: <TASK> __do_sys_delete_module+0x318/0x580 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f As bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init() will cleanup all resource. Then when remove bnep module will call bnep_sock_cleanup() to cleanup sock's resource. To solve above issue just return bnep_sock_init()'s return value in bnep_exit(). Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Ye Bin <[email protected]> Signed-off-by: Luiz Augusto von Dentz <[email protected]> (cherry picked from commit 64a9099) Signed-off-by: Jonathan Maple <[email protected]>
1 parent 4772c72 commit fd1a95d

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

net/bluetooth/bnep/core.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -744,8 +744,7 @@ static int __init bnep_init(void)
744744
if (flt[0])
745745
BT_INFO("BNEP filters: %s", flt);
746746

747-
bnep_sock_init();
748-
return 0;
747+
return bnep_sock_init();
749748
}
750749

751750
static void __exit bnep_exit(void)

0 commit comments

Comments
 (0)